4855202c98
Error: $ sudo fwknopd -f -c /etc/fwknop/fwknopd.conf Starting fwknopd Added jump rule from chain: INPUT to chain: FWKNOP_INPUT iptables 'comment' match is available Sniffing interface: ppp0 [*] pcap_open_live() error: ppp0: You don't have permission to capture on that device (socket: Permission denied) Syslog: [...] kernel: [...] type=1400 audit([...]): apparmor="DENIED" operation="create" profile="/usr/sbin/fwknopd" pid=[...] comm="fwknopd" family="packet" sock_type="dgram" protocol=768
33 lines
684 B
Plaintext
33 lines
684 B
Plaintext
# Last Modified: Sun Aug 18 22:54:57 2013
|
|
# Assumes fwknopd was built with:
|
|
# './configure --prefix=/usr --sysconfdir=/etc --localstatedir=/run'
|
|
#include <tunables/global>
|
|
|
|
/usr/sbin/fwknopd {
|
|
#include <abstractions/base>
|
|
|
|
capability ipc_lock,
|
|
capability net_admin,
|
|
capability net_raw,
|
|
|
|
network inet raw,
|
|
network packet raw,
|
|
network packet dgram,
|
|
|
|
/bin/dash rix,
|
|
/bin/bash rix,
|
|
/etc/fwknop/access.conf r,
|
|
/etc/fwknop/fwknopd.conf r,
|
|
/etc/nsswitch.conf r,
|
|
/etc/passwd r,
|
|
/etc/protocols r,
|
|
/root/.gnupg/* rwkl,
|
|
/run/fwknop/ rw,
|
|
/run/fwknop/* rwk,
|
|
/sbin/xtables-multi rix,
|
|
/usr/bin/gpg rix,
|
|
/usr/sbin/fwknopd mr,
|
|
/var/cache/nscd/passwd r,
|
|
|
|
}
|